CVE-2026-89410Medium· 5.1▾ SunlitIn Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive information.
z-wave_sdk <= 8.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-89409Medium· 5.3Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes
CVE-2026-85079High· 7.5Out-of-bounds write in Zigbee Simple_Desc_req handling
CVE-2026-66279High· 7.2Dis-connect vulnerability in Connect Stack
CVE-2026-66282Medium· 6.0Authenticated Denial-of-Service in Zigbee Publish Billing Period
CVE-2026-94502High· 7.5Out-of-bounds write in Zigbee Publish Price Matrix handling
CVE-2026-85080Medium· 6.0Authenticated Denial-of-Service in Zigbee GetGroupMembership Handling